Optimal ratio between phase basis and bit basis in QKD 
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In the original BB84 protocol, the bit basis and the phase basis are used with equal probability. 
Lo et al (J. of Cryptology, 18, 133-165 (2005)) proposed to modify the ratio between the two bases 
by increasing the final key generation rate. However, the optimum ratio has not been derived. 
In this letter, in order to examine this problem, the ratio between the two bases is optimized for 
exponential constraints given Eve's information distinguishability and the final error probability. 



oo 

o 

O 

C 
3 



43 ■ 

i ' 

> ■ 

G ■ 

a ■ 

=5 

cr 



> 
O 
&\ 

cn 

in 
o 
oo 
O 



Bennett & Brasserd Q proposed the BB84 protocol for 
quantum key distribution. It was shown that this pro- 
tocol generates secret random bits between two distinct 
parties even though the quantum channel has noise 0, 
Once a security proof was obtained for this protocol, 
many researchers @, |, 0, 0, S, & M, EL E El im- 
proved the key generation rate. Lo et al [14( proposed to 
improve the key generation rate by modifying the ratio 
between the bit(+) basis and the phase(x) basis. In the 
original BB84 protocol, the sender Alice and the receiver 
Bob choose the + basis and the x basis with equal proba- 
bility. However, this equal ratio is not essential, because 
the purpose of a random basis choice is estimating the 
phase error rate in the channel of the qubits in the co- 
incidence basis. That is, in order to generate the secure 
keys from the raw keys with the + basis, it is sufficient 
to estimate the + error rate precisely. The aim of the 
present letter is to improve the key generation rate by 
modifying the ratio between two bases. 

For example, the following protocol improves the key 
generation rate. When Alice and Bob communicate N 
qubits, Alice and Bob use the x basis only in the ran- 
domly chosen y/~N qubits and use the + basis in the re- 
maining N — \/N qubits. In the above protocol, when 
the length of the code N is sufficiently large, Alice and 
Bob can estimate the phase error rate precisely. Since 
y/W /N approaches zero, the rate of discarded qubits ap- 
proaches zero. That is, it is possible that the generation 
rate of the raw keys with transmitted qubits is almost 
100%. Hence, in order to optimize this ratio, we have 
to choose a suitable formulation. Due to the difficulty of 
the formulation, this optimization has not been treated in 
existing researches. As a possible formulation, one may 
consider the optimization of the final key generation rate 
with a constant constraint for Eve's information in the fi- 



nite length code. However, as is discussed by Lo et al[14j. 
Hayashi [l5| , and Scarani and Renner [li} , the formula of 
finite length code is not simple. Furthermore, its analysis 
depends on the length of the code. 

This letter focuses on the exponential constraint as an 
intermediate criterion between the finite-length case and 
the infinite-length case. Exponential rate is a common 
measure in information theor y 11 'il l, and it was discussed 
in QKD by several papers [la, [Ha, [l9| . That is, we treat 
exponential constraints for the block error probability for 



final keys and for Eve's information distinguishability for 
final keys This letter optimizes the final key genera- 
tion rate based on the key distillation protocol given by 
Hayashi li|, 21 1. In this key distillation protocol, first, 
a classical error correction is performed. Next, privacy 
amplification using the Toep litz matrix, which is an eco- 
nomical random matrix [2a [23[, is performed. Hence, 
Eve's information distinguishability can be characterized 
by the phase error probability of the corresponding CSS 
code. 

For a simpler analysis, a single photon source and the 
lossless quantum channel are assumed to be available. 
Furthermore, as an ideal assumption, the random coding 
and the maximum likelihood decoding are assumed to be 
performed in the classical error correction part. 

[Result] 

This letter focuses on the asymmetric protocol, in 
which, Alice and Bob use the x basis with ratio p 2 , and 
they announce the check bits, which are randomly cho- 
sen with ratio p\ among the bits whose Alice's basis and 
Bob's basis are the + basis. (As shown later, the optimal 
case is given when the ratio of x basis by Alice is equal 
to that used by Bob.) The performance of the protocol is 
characterized by the final error probability of the classical 
error correction and Eve's information distinguishability. 
The latter is equal to \\pae — PA® Pe\\i for Eve's final 
state PE-, Alice's final state pa, and the final state pae 
of the joint system of the final keys. 

Both quantities depend on the number N of transmit- 
ted qubits, the observed error rates q+ of + basis, and 
the observed error rates q x of x basis. However, both 
quantities cannot be determined by the above values be- 
cause these depend on Eve's attack. Hence, it is possi- 
ble to compute only both upper bounds, i.e., the upper 
bound Bb(N,pi,p2, q+) of the final error probability and 
the upper bound B„(N, p-\,P2,Q-x) of Eve's information 



distinguishability [l5|, [2l|, which do not depend on Eve's 
attack. For a given constant C, the following exponential 
constraint is considered: 

Jim ^-\ogB b {N,p 1 ,p 2l q+)>C (1) 

Jim ^-logB p (N,p uP2 ,q x )>C. (2) 

Then, the main target is the calculation of the rates 



2 



Pi and P2 optimizing the final key generation rate 
Ra(pitP2, Q+, qx , C) under the conditions (p} and (2}, 
when q := q + = q y . 

In this letter, these values are numerically calculated 
using the logarithm base 2 with C = 0.0001. For exam- 
ple, when N = 100,000, 2-° N = 2- w . However, since 
the quantity B p (N,pi,p 2 ,qx) has some polynomial fac- 
tor, it is greater than 2~ 10 . 

Next, we consider the symmetric protocol, in which 
x basis is chosen with the same ratio with the + ba- 
sis in both sides. In this case, it is possible to control 
only the ratio p\ of the check bits. The original BB84 
protocol is given in this case as p\ = 1/2. Then, we 
numerically calculate the rate p\ optimizing the final 
key generation rate i?s(pi, g+, q x , C) under the condi- 
tions (TTJ) and @, when q := q + = q x . The numeri- 
cal results of max < PliP ,<i/ 2 Ra(pi,P2, q, q, 0.0001) and 
max < Pl <i/2 Rs(pi, q, q, 0.0001) are shown in Figure [T] 



Fig. [3]shows argmax < p2 < 1/2 max < Pl <i/2 R A {pi,P2,q, q, 0.0001). 
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FIG. 3: Optimal choice rate of x basis 
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FIG. 1: Asymptotic key generation rate: The upper line 
shows max Ra, while the lower line shows maxi?s- 

Using the above results, we obtain Fig. [21 which shows 
argmax < pi < 1/2 max < P2 < 1/2 R A (p 1 ,p 2 ,q, q, 0.0001) and 
argmaxo< pi < 1/2 R s {pi,q, q, 0.0001). 
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FIG. 2: Optimal choice rate for the check bits: The upper 
line is argmaxi?s, while the lower line is argmaxT?^. 



[Derivation] 

The above figures are derived by combining the type 
method [25[ and the analysis in HavashiflBj as follows. 
In this letter, we discuss the security based on the key 
distillation protocol given in Hayashi 15], in which, af- 
ter the generation of raw keys, the classical error correc- 
tion is performed using a pseudo-classical noisy channel, 
and random privacy amplification is applied using the 
Toeplitz matrix. Similar to Hayashi [15], the following 
derivation focuses on the discrete (partial)-twirled chan- 
nel, by considering the phase error rate and the bit error 
rate of this channel corresponding to the raw keys. 

Let us calculate the probability that the esti- 
mated phase error rate is q x , and the 
ror rate among raw keys is q' x . As 
in Hayashi [3], this probability can be 
using the hypergeometric distribution, 

(( Npl \(N(l~p 2 ) 2 (l- Pl )\ i w/ JV(p 2 + (l-p 2 ) 2 (l 



\Np%q x J \N(l-p 2 ) 2 (l-pi) 

where N is the 



phase er- 
discussed 
evaluated 
that is, 

pO) \ 

Nplq x +N(l-p 2 ) 2 (l- Pl )q' x J ' 

total number of transmit- 



ted qubits. Since _L_2 nh(k ^ ri 

2 nfc(fe/") ) this probability is 

(( Npl WJV(l-p 2 ) 2 (l-pih , s/c JV(p2+(i-P2) 2 (i-pi)) 
^NpIq^) \N(l-p 2 )' 2 (l-pi)) q 'x ' I \Nplqy,+N(l 
2-A f D P (pi,P2,g x >i'x ) 



\Npi.q 



< (2) 

bounded 

P2) 2 
-P2) 



< 

by 

< 



A r (p| + (1-P2) 2 (l-Pi)) + 1' 



(1-Pl)<?> 
where the exponential 



decreasing rate is given by 

D p (pi,P2,qx,q' x ) 
:=(pt + (l-p 2 f(l- Pl ))h( 



v\qx 



+ {l- V2 f{\- Vl ) q ' > 



pl + (l- F2 )2(i_ pi ) 



- plHqx) - (1 - P2?(l - PlMq' x ). 

When the phase error rate among raw keys is q' y , the 
random privacy amplification with the sacrificed bit rate 
S 2 reduces the block error probability of final keys in 
the x basis to 6 p (q' x ) := 2- N ^ 2 -^-P^ 2 ^- pi ^ q 'x^+^, 
where [x]+ is x for a positive number a; while [x\+ is 
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zero for a negative number x. Since q' x takes the val- 
ues in {0, 1/N, 2/N, . . . , 1}, the (block) error probability 
of the final keys in the x basis is upperly bounded by 
B p (N,pi,p 2 ,q x ) := Efco e p(D lJ p(s)|-H ence ' applying 
the type method to the parameter q x [2511 . w e obtain its 
exponential decreasing rate (See Hayashi[l5|): 

N—>OG 1\ 

= mm ([5 a - (1 - p 2 ) 2 (l - pi)h(q' x )]+ 

°<9x <l/2 \ 

+ Dp(p 1 ,p 2 ,q >< ,q' x )y (3) 

In the following discussion, S2{pi,p 2 , q x , C) presents the 
solution 5 2 of Q = C. In fact, Eve's Holevo information 
Xe and Eve's distinguishability ||pa,_e — Pa® Pe\\i are 
characterized by flBI l2l| 

Exb < {-logB p (N,p u p 2 ,q x ) + M) ■ B p {N, P i,p 2 ,q x ) 
~E\\pa,e - PA® Pe\\i < Emax|jp Bi x - Pe\\i 

X 

< B p (N,p 1 ,p 2 ,q x ), 

where E denotes the average concerning random pri- 
vacy amplification, M denotes the length of the final 
keys, and pe,x is Eve's state when the final key is X. 
Hence, B p (N,pi,p2,qx) can be regarded as an upper 
bound for Eve's distinguishability. Thus, the quantity 
52 (pi ) P2i q x , C) is the minimum sacrificed bit rate in the 
random privacy under the condition that the exponential 
decreasing rate of the upper bound of Eve's distinguisha- 
bility is greater than C. 

Now, it will be shown why the rate p 2 ,A of x basis of 
Alice is assumed to be equal to the rate P2,b of x basis of 
Bob. If different rates are chosen, then the performance 
is characterized by the coincidence probability in +basis 
(1-P2,a)(1-P2,b) = 1+F2,AP2,b-2(P2,A+P2,b) and the 
coincidence probability in x basis p 2 ,AP2.B- Hence, it is 
sufficient to maximize the the coincidence probability in 
-l-basis (1-P2,a)(1-P2,b) = ^+P2,aP2,b-^{P2,a+Pi,b) 
with the condition that the coincidence probability in 
x basis P2,aP2,b is equal to an arbitrary constant P. This 
maximum value is given when P2,a — P2.B — ^fP ■ Thus, 
it is suitable to consider only the case of P2,A = P2,b- 

In order to express the rate of sacrificed bits 
S2(pi,P2,qx,C) as a function of the constraint C, we 
introduce two quantities, q' x 1 and q' x 2 as the solutions 
of the following equations in the range [0, 1/2]: 

D P (pi,P2,qx,q Xi i) = C 

p\q x + (l-p 2 ) 2 {l -pi)q' Xi2 = q'x, 2 )2 

p§(l - ?x) + (1 - P2) 2 (l Pl)(l - q' x , 2 ) [ 1 - <f x ,2 } ' 

Then, the rate of sacrificed bits S2{pi,P2, Q x , C) is given 
as follows. 



when q' x x < q' x 2 . Otherwise, 

S 2 {jpi,P2,q x ,C) = Dp(pi,p 2 ,q x ,q' x2 ) +C. 

Next, we consider the (block) error probability of the 
final keys in the case when Gallager random coding and 
maximum likelihood decoding are applied[17]. When the 
bit error rate of the raw keys is q' + and the rate of 
sacrificed bits in classical error correction is Si, the fi- 
nal error probability is upperly bounded by eb(q'+) "■= 
2 -N[s 1 ~(i~p 2 ) 2 (i- Pl )h( q ' + )] + _ We calculate the probabil- 
ity that the estimate of the bit error rate is q+ and the 
phase error bit among raw keys is q' + . Similar to the 
case of the bit error rate, by using the hypergeomet- 
ric distribution, this probability is upperly bounded by 

5b(q' + ) ■= - — N(i-p 2 y i +i + ' wnere the exponential de- 
creasing rate is given by 

Db(pi,P2,q+,q'+) 
:=(1 -P2) 2 (h{p iq+ + (1 - pi)q' + ) - pih(q+) 

-(l-pi)h(q' + )). 

Thus, the (block) error probability of the final keys in 
the + basis is upperly bounded by Bb(N,pi,p 2 ,q+) := 
yit—n ^h(jr)Sh(jr)- Applying the type method to the 
parameter (7+[25|, we obtain the exponential decreasing 
rate: 

lim -^\ogBb(N,pi,p 2 ,q + ) 
= min D b (pi,P2,q+,q' + ) 

0<q' + <l/2 

+ [Si-(l-p2) 2 (l- P i)h(q' + )} + . (4) 

In the following, Si{pi,p2, q+, C) presents the solution Si 
of (21) = C. Thus, the quantity, 5i(pi, P2, q+, C), is the 
minimum sacrificed bit rate in the classical error correc- 
tion under the condition that the exponential decreasing 
rate of the upper bound of error probability of the final 
keys is greater than C. 

Similar to 5 2 (pi,p2, <?x> C), in order to express the the 
rate of sacrificed bits Si(pi,p2,q x , C) as a function of the 
constraint C, we introduce two quantities, q' + 1 and q' + 2 
as the solutions of the following in the range [0, 1/2]: 

Db(pi,P2,q+,q' +yl ) = C 

piq+ + (1 -pi)q' +a _ . q'+,2 )2 

Pl (i_ g+ ) + (i- Pl )(l-g / +l2 ) _l i-^, 2 ' 

Therefore, Si(pi,p 2 , q x , C) is given as a function of the 
constraint C as follows. When q' + 1 < q' + 2 , 

Si(pi,P2,q+,C) = (1 -p 2 ) 2 (l ~pi)h(q' +1 ). 
Otherwise, 



S 2 (pi,P2,qx,C) = (1 -p 2 ) 2 (l -pi)h{q' Xi i) 



Si(pi,P2,q+,C) = D b (pi,p2,q+,q' +t2 ) +C. 
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Hence, the final key generation rate Ra{pi,P2, 9+> <Zxi C) 
is given by 

RA(pi,P2,q+,qx,C) 
= (1 -P2) 2 (l -pi) - Si(pi,p 2 ,q+,C) - S 2 (pi,P2,qx,C). 

Next, we consider the final key generation rate 
R-sipi) q+i <Zx> C) in the symmetric case. In this case, 
the exponential decreasing rate of the final error prob- 
ability is given by substituting 1/2 into p 2 in the 
formula S\(p\,p2,q+,C). The exponential decreasing 
rate of Eve's distinguishability is given by substitut- 
ing 1/2 into P2 in the formula S\{p\,p2, q x , C). Thus, 
Rs(pi, q+,qx, C) is calculated by 

Rs(pi,q+,qx,C) 

= ^—^-S l (p x ,l/2,q + ,E)-S x {p u l/2,q y< ,C). 

Therefore, applying numerical analysis to these formu- 
lae, we obtain Figs. HHH and[3l 

[Discussion] 

It has been shown that the asymmetric protocol im- 
proves the symmetric protocol under an exponential con- 
straint condition based on the analysis on Hayashi [lij]. 
This result suggests the importance of the choice of the 
ratio between the two bases when designing QKD system. 



A similar result can be expected based on Lo et al [14 1 
and Scarani [l6j]. It is interesting to compare the obtained 
result with those based on Lo et al [L4j and Scarani and 
Renner [l6|]. A similar result can be expected in the de- 
coy met hod [26, 27, 28, 2j|. Future work will investigate 
the same problem in the finite-length framework using 
the decoy method 30]. As well, it has been shown in 
this letter that the exponential rate is a useful criterion 
for the case of limited coding length. It is interesting to 
apply this criterion to other topics in QKD. 
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